Max/XTLS_Xray-docs-next
1
0
Fork 0
mirror of https://github.com/XTLS/Xray-docs-next.git synced 2026-09-22 22:38:05 +03:00
Code Issues Packages Projects Releases Wiki Activity

Refactor finalmask

Browse Source
This commit is contained in:
Fangliding
2026-06-17 20:15:32 +08:00
parent f37805efcd
commit b300eed5e8
3 changed files with 465 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/config/transports/finalmask.md
+155 -95
View File
@@ -73,51 +73,57 @@ FinalMask 在核心处理完包括 TLS/REALITY 在内的传输层加密后，对
}
```
> `type`: header-custom | fragment | sudoku
> `type`: string
该层伪装的类型。
> `settings`: header-custom | fragment | sudoku
> `settings`: string
该伪装类型的具体设置（每个类型的字段见下）
该伪装类型的具体设置。
每个类型的字段见下
### header-custom
```json
{
"clients": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
"type": "header-custom",
// [!code focus:35]
"settings": {
"clients": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
],
"servers": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
],
"errors": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
]
],
"servers": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
],
"errors": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
]
}
}
```
@@ -135,10 +141,14 @@ FinalMask 在核心处理完包括 TLS/REALITY 在内的传输层加密后，对
```json
{
"packets": "tlshello",
"length": "100-200",
"delay": "10-20",
"maxSplit": "3-6"
"type": "fragment",
// [!code focus:6]
"settings": {
"packets": "tlshello",
"length": "100-200",
"delay": "10-20",
"maxSplit": "3-6"
}
}
```
@@ -160,14 +170,18 @@ FinalMask 在核心处理完包括 TLS/REALITY 在内的传输层加密后，对
```json
{
"password": "",
"ascii": "",
"type": "sudoku",
// [!code focus:10]
"settings": {
"password": "",
"ascii": "",
"customTable": "", // 官方文档字段名为 custom_table
"customTables": [""], // 官方文档字段名为 custom_tables
"customTable": "", // 官方文档字段名为 custom_table
"customTables": [""], // 官方文档字段名为 custom_tables
"paddingMin": 0, // 官方文档字段名为 padding_min
"paddingMax": 0 // 官方文档字段名为 padding_max
"paddingMin": 0, // 官方文档字段名为 padding_min
"paddingMax": 0 // 官方文档字段名为 padding_max
}
}
```
@@ -191,13 +205,15 @@ FinalMask 在核心处理完包括 TLS/REALITY 在内的传输层加密后，对
}
```
> `type`: header-custom | header-dns | header-dtls | header-srtp | header-utp | header-wechat | header-wireguard | mkcp-original | mkcp-aes128gcm | noise | salamander | sudoku | xdns | xicmp
> `type`: string
该层伪装的类型。
> `settings`: header-custom | header-dns | mkcp-aes128gcm | noise | salamander | sudoku | xdns | xicmp
> `settings`: string
该伪装类型的具体设置（每个类型的字段见下）
该伪装类型的具体设置。
每个类型的字段见下
### header-custom
@@ -205,22 +221,26 @@ FinalMask 在核心处理完包括 TLS/REALITY 在内的传输层加密后，对
```json
{
"client": [
{
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
],
"server": [
{
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
"type": "header-custom",
// [!code focus:18]
"settings": {
"client": [
{
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
],
"server": [
{
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
}
}
```
@@ -236,14 +256,30 @@ FinalMask 在核心处理完包括 TLS/REALITY 在内的传输层加密后，对
```json
{
"header": "", // dns dtls srtp utp wechat wireguard
"value": "" // password domain
"type": "mkcp-legacy",
// [!code focus:4]
"settings": {
"header": "", // dns dtls srtp utp wechat wireguard
"value": "" // password domain
}
}
```
`header`: empty for original & aes128gcm
旧 mKCP 的包头伪装/混淆，`value` 的含义随 `header` 变化。注意伪造只是简单的包头伪造，不代表实现了完整协议。
`value`: empty for original
> 为空时: 进行 AES-128-GCM 加密，`value` 为其密码，若 `value` 为空则改为使用默认的简单 xor 混淆。
> `dns`: 伪造为 DNS 查询，`value` 为指定的域名，为空时默认 `www.baidu.com`。
> `dtls`: 伪造为 DTLS 1.2 应用数据，`value` 无作用。
> `srtp`: 伪造为 SRTP。`value` 无作用。
> `utp`: 伪造为 uTP（BitTorrent）。`value` 无作用。
> `wechat`: 伪造为微信视频通话。`value` 无作用。
> `wireguard`: 伪造为 WireGuard。`value` 无作用。
### noise
@@ -251,16 +287,20 @@ FinalMask 在核心处理完包括 TLS/REALITY 在内的传输层加密后，对
```json
{
"reset": "30-60",
"noise": [
{
"rand": "1-8192",
"randRange": "0-255",
"type": "",
"packet": [],
"delay": "10-20"
}
]
"type": "noise",
// [!code focus:12]
"settings": {
"reset": "30-60",
"noise": [
{
"rand": "1-8192",
"randRange": "0-255",
"type": "",
"packet": [],
"delay": "10-20"
}
]
}
}
```
@@ -282,7 +322,11 @@ Salamander 混淆。（来自 Hysteria2）
```json
{
"password": "your-password"
"type": "salamander",
// [!code focus:3]
"settings": {
"password": "your-password"
}
}
```
@@ -290,14 +334,18 @@ Salamander 混淆。（来自 Hysteria2）
```json
{
"password": "",
"ascii": "",
"type": "sudoku",
// [!code focus:10]
"settings": {
"password": "",
"ascii": "",
"customTable": "",
"customTables": [""],
"customTable": "",
"customTables": [""],
"paddingMin": 0,
"paddingMax": 0
"paddingMin": 0,
"paddingMax": 0
}
}
```
@@ -317,8 +365,12 @@ Salamander 混淆。（来自 Hysteria2）
```json
{
"domains": ["t.example.com"],
"resolvers": ["t.example.com+udp://8.8.8.8:53"]
"type": "xdns",
// [!code focus:4]
"settings": {
"domains": ["t.example.com"],
"resolvers": ["t.example.com+udp://8.8.8.8:53"]
}
}
```
@@ -332,8 +384,12 @@ Salamander 混淆。（来自 Hysteria2）
```json
{
"dgram": false, // optional
"ips": [] // optional
"type": "xicmp",
// [!code focus:4]
"settings": {
"dgram": false, // optional
"ips": [] // optional
}
}
```
@@ -347,12 +403,16 @@ Salamander 混淆。（来自 Hysteria2）
```json
{
"url": "realm://public@xxx/your-realm-name",
"stunServers": [
"stun.nextcloud.com:3478",
"global.stun.twilio.com:3478"
],
"tlsConfig": {} // optional
"type": "realm",
// [!code focus:8]
"settings": {
"url": "realm://public@xxx/your-realm-name",
"stunServers": [
"stun.nextcloud.com:3478",
"global.stun.twilio.com:3478"
],
"tlsConfig": {} // optional
}
}
```
docs/en/config/transports/finalmask.md
+155 -95
View File
@@ -73,51 +73,57 @@ An array used to camouflage TCP traffic emitted by the core. The first item in t
}
```
> `type`: header-custom | fragment | sudoku
> `type`: string
The type of this camouflage layer.
> `settings`: header-custom | fragment | sudoku
> `settings`: string
The concrete settings for this camouflage type. See the fields for each type below.
The concrete settings for this camouflage type.
See the fields for each type below.
### header-custom
```json
{
"clients": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
"type": "header-custom",
// [!code focus:35]
"settings": {
"clients": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
],
"servers": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
],
"errors": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
]
],
"servers": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
],
"errors": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
]
}
}
```
@@ -135,10 +141,14 @@ The concrete settings for this camouflage type. See the fields for each type bel
```json
{
"packets": "tlshello",
"length": "100-200",
"delay": "10-20",
"maxSplit": "3-6"
"type": "fragment",
// [!code focus:6]
"settings": {
"packets": "tlshello",
"length": "100-200",
"delay": "10-20",
"maxSplit": "3-6"
}
}
```
@@ -160,14 +170,18 @@ When it is `0` and `"packets": "tlshello"` is set, the fragmented Client Hello w
```json
{
"password": "",
"ascii": "",
"type": "sudoku",
// [!code focus:10]
"settings": {
"password": "",
"ascii": "",
"customTable": "", // field name is custom_table in the upstream documentation
"customTables": [""], // field name is custom_tables in the upstream documentation
"customTable": "", // field name is custom_table in the upstream documentation
"customTables": [""], // field name is custom_tables in the upstream documentation
"paddingMin": 0, // field name is padding_min in the upstream documentation
"paddingMax": 0 // field name is padding_max in the upstream documentation
"paddingMin": 0, // field name is padding_min in the upstream documentation
"paddingMax": 0 // field name is padding_max in the upstream documentation
}
}
```
@@ -191,13 +205,15 @@ An array used to camouflage UDP traffic emitted by the core. The first item in t
}
```
> `type`: header-custom | header-dns | header-dtls | header-srtp | header-utp | header-wechat | header-wireguard | mkcp-original | mkcp-aes128gcm | noise | salamander | sudoku | xdns | xicmp
> `type`: string
The type of this camouflage layer.
> `settings`: header-custom | header-dns | mkcp-aes128gcm | noise | salamander | sudoku | xdns | xicmp
> `settings`: string
The concrete settings for this camouflage type. See the fields for each type below.
The concrete settings for this camouflage type.
See the fields for each type below.
### header-custom
@@ -205,22 +221,26 @@ Always merged into the packet header.
```json
{
"client": [
{
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
],
"server": [
{
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
"type": "header-custom",
// [!code focus:18]
"settings": {
"client": [
{
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
],
"server": [
{
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
}
}
```
@@ -236,14 +256,30 @@ Always merged into the packet header.
```json
{
"header": "", // dns dtls srtp utp wechat wireguard
"value": "" // password domain
"type": "mkcp-legacy",
// [!code focus:4]
"settings": {
"header": "", // dns dtls srtp utp wechat wireguard
"value": "" // password domain
}
}
```
`header`: empty for original & aes128gcm
Legacy mKCP packet-header camouflage/obfuscation. The meaning of `value` depends on `header`. Note that the forgery is only a simple packet-header forgery and does not mean the full protocol is implemented.
`value`: empty for original
> When empty: applies AES-128-GCM encryption with `value` as the password. If `value` is empty, it falls back to the default simple XOR obfuscation.
> `dns`: forged as a DNS query. `value` is the specified domain; defaults to `www.baidu.com` when empty.
> `dtls`: forged as DTLS 1.2 application data. `value` has no effect.
> `srtp`: forged as SRTP. `value` has no effect.
> `utp`: forged as uTP (BitTorrent). `value` has no effect.
> `wechat`: forged as a WeChat video call. `value` has no effect.
> `wireguard`: forged as WireGuard. `value` has no effect.
### noise
@@ -251,16 +287,20 @@ Noise sent before the actual data.
```json
{
"reset": "30-60",
"noise": [
{
"rand": "1-8192",
"randRange": "0-255",
"type": "",
"packet": [],
"delay": "10-20"
}
]
"type": "noise",
// [!code focus:12]
"settings": {
"reset": "30-60",
"noise": [
{
"rand": "1-8192",
"randRange": "0-255",
"type": "",
"packet": [],
"delay": "10-20"
}
]
}
}
```
@@ -282,7 +322,11 @@ Salamander obfuscation. From Hysteria2.
```json
{
"password": "your-password"
"type": "salamander",
// [!code focus:3]
"settings": {
"password": "your-password"
}
}
```
@@ -290,14 +334,18 @@ Salamander obfuscation. From Hysteria2.
```json
{
"password": "",
"ascii": "",
"type": "sudoku",
// [!code focus:10]
"settings": {
"password": "",
"ascii": "",
"customTable": "",
"customTables": [""],
"customTable": "",
"customTables": [""],
"paddingMin": 0,
"paddingMax": 0
"paddingMin": 0,
"paddingMax": 0
}
}
```
@@ -317,8 +365,12 @@ For example, if you own `example.com`, set an A record like `a.example.com` to t
```json
{
"domains": ["t.example.com"],
"resolvers": ["t.example.com+udp://8.8.8.8:53"]
"type": "xdns",
// [!code focus:4]
"settings": {
"domains": ["t.example.com"],
"resolvers": ["t.example.com+udp://8.8.8.8:53"]
}
}
```
@@ -332,8 +384,12 @@ At least one of `domains` and `resolvers` must be set.
```json
{
"dgram": false, // optional
"ips": [] // optional
"type": "xicmp",
// [!code focus:4]
"settings": {
"dgram": false, // optional
"ips": [] // optional
}
}
```
@@ -347,12 +403,16 @@ Self-built https://github.com/apernet/hysteria-realm-server
```json
{
"url": "realm://public@xxx/your-realm-name",
"stunServers": [
"stun.nextcloud.com:3478",
"global.stun.twilio.com:3478"
],
"tlsConfig": {} // optional
"type": "realm",
// [!code focus:8]
"settings": {
"url": "realm://public@xxx/your-realm-name",
"stunServers": [
"stun.nextcloud.com:3478",
"global.stun.twilio.com:3478"
],
"tlsConfig": {} // optional
}
}
```
docs/ru/config/transports/finalmask.md
+155 -95
View File
@@ -73,51 +73,57 @@ FinalMask добавляет последний слой маскировки п
}
```
> `type`: header-custom | fragment | sudoku
> `type`: string
Тип этого слоя маскировки.
> `settings`: header-custom | fragment | sudoku
> `settings`: string
Конкретные настройки для этого типа маскировки. Поля каждого типа приведены ниже.
Конкретные настройки для этого типа маскировки.
Поля каждого типа приведены ниже.
### header-custom
```json
{
"clients": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
"type": "header-custom",
// [!code focus:35]
"settings": {
"clients": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
],
"servers": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
],
"errors": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
]
],
"servers": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
],
"errors": [
[
{
"delay": 0,
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
]
}
}
```
@@ -135,10 +141,14 @@ FinalMask добавляет последний слой маскировки п
```json
{
"packets": "tlshello",
"length": "100-200",
"delay": "10-20",
"maxSplit": "3-6"
"type": "fragment",
// [!code focus:6]
"settings": {
"packets": "tlshello",
"length": "100-200",
"delay": "10-20",
"maxSplit": "3-6"
}
}
```
@@ -160,14 +170,18 @@ FinalMask добавляет последний слой маскировки п
```json
{
"password": "",
"ascii": "",
"type": "sudoku",
// [!code focus:10]
"settings": {
"password": "",
"ascii": "",
"customTable": "", // в upstream-документации поле называется custom_table
"customTables": [""], // в upstream-документации поле называется custom_tables
"customTable": "", // в upstream-документации поле называется custom_table
"customTables": [""], // в upstream-документации поле называется custom_tables
"paddingMin": 0, // в upstream-документации поле называется padding_min
"paddingMax": 0 // в upstream-документации поле называется padding_max
"paddingMin": 0, // в upstream-документации поле называется padding_min
"paddingMax": 0 // в upstream-документации поле называется padding_max
}
}
```
@@ -191,13 +205,15 @@ FinalMask добавляет последний слой маскировки п
}
```
> `type`: header-custom | header-dns | header-dtls | header-srtp | header-utp | header-wechat | header-wireguard | mkcp-original | mkcp-aes128gcm | noise | salamander | sudoku | xdns | xicmp
> `type`: string
Тип этого слоя маскировки.
> `settings`: header-custom | header-dns | mkcp-aes128gcm | noise | salamander | sudoku | xdns | xicmp
> `settings`: string
Конкретные настройки для этого типа маскировки. Поля каждого типа приведены ниже.
Конкретные настройки для этого типа маскировки.
Поля каждого типа приведены ниже.
### header-custom
@@ -205,22 +221,26 @@ FinalMask добавляет последний слой маскировки п
```json
{
"client": [
{
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
],
"server": [
{
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
"type": "header-custom",
// [!code focus:18]
"settings": {
"client": [
{
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
],
"server": [
{
"rand": 0,
"randRange": "0-255",
"type": "",
"packet": []
}
]
}
}
```
@@ -236,14 +256,30 @@ FinalMask добавляет последний слой маскировки п
```json
{
"header": "", // dns dtls srtp utp wechat wireguard
"value": "" // password domain
"type": "mkcp-legacy",
// [!code focus:4]
"settings": {
"header": "", // dns dtls srtp utp wechat wireguard
"value": "" // password domain
}
}
```
`header`: empty for original & aes128gcm
Маскировка/обфускация заголовка пакетов в стиле старого mKCP. Значение `value` зависит от `header`. Обратите внимание: подделка - это лишь простая подделка заголовка пакета и не означает реализацию полного протокола.
`value`: empty for original
> Когда пусто: применяется шифрование AES-128-GCM, где `value` - пароль. Если `value` пусто, вместо этого используется простая XOR-обфускация по умолчанию.
> `dns`: подделка под DNS-запрос. `value` - указанный домен; при пустом значении по умолчанию `www.baidu.com`.
> `dtls`: подделка под данные приложения DTLS 1.2. `value` не используется.
> `srtp`: подделка под SRTP. `value` не используется.
> `utp`: подделка под uTP (BitTorrent). `value` не используется.
> `wechat`: подделка под видеозвонок WeChat. `value` не используется.
> `wireguard`: подделка под WireGuard. `value` не используется.
### noise
@@ -251,16 +287,20 @@ FinalMask добавляет последний слой маскировки п
```json
{
"reset": "30-60",
"noise": [
{
"rand": "1-8192",
"randRange": "0-255",
"type": "",
"packet": [],
"delay": "10-20"
}
]
"type": "noise",
// [!code focus:12]
"settings": {
"reset": "30-60",
"noise": [
{
"rand": "1-8192",
"randRange": "0-255",
"type": "",
"packet": [],
"delay": "10-20"
}
]
}
}
```
@@ -282,7 +322,11 @@ FinalMask добавляет последний слой маскировки п
```json
{
"password": "your-password"
"type": "salamander",
// [!code focus:3]
"settings": {
"password": "your-password"
}
}
```
@@ -290,14 +334,18 @@ FinalMask добавляет последний слой маскировки п
```json
{
"password": "",
"ascii": "",
"type": "sudoku",
// [!code focus:10]
"settings": {
"password": "",
"ascii": "",
"customTable": "",
"customTables": [""],
"customTable": "",
"customTables": [""],
"paddingMin": 0,
"paddingMax": 0
"paddingMin": 0,
"paddingMax": 0
}
}
```
@@ -317,8 +365,12 @@ FinalMask добавляет последний слой маскировки п
```json
{
"domains": ["t.example.com"],
"resolvers": ["t.example.com+udp://8.8.8.8:53"]
"type": "xdns",
// [!code focus:4]
"settings": {
"domains": ["t.example.com"],
"resolvers": ["t.example.com+udp://8.8.8.8:53"]
}
}
```
@@ -332,8 +384,12 @@ FinalMask добавляет последний слой маскировки п
```json
{
"dgram": false, // optional
"ips": [] // optional
"type": "xicmp",
// [!code focus:4]
"settings": {
"dgram": false, // optional
"ips": [] // optional
}
}
```
@@ -347,12 +403,16 @@ FinalMask добавляет последний слой маскировки п
```json
{
"url": "realm://public@xxx/your-realm-name",
"stunServers": [
"stun.nextcloud.com:3478",
"global.stun.twilio.com:3478"
],
"tlsConfig": {} // optional
"type": "realm",
// [!code focus:8]
"settings": {
"url": "realm://public@xxx/your-realm-name",
"stunServers": [
"stun.nextcloud.com:3478",
"global.stun.twilio.com:3478"
],
"tlsConfig": {} // optional
}
}
```